layer: chore/6th-hygiene-2026-06-08 — chore(security): add OpenSSF Scorecard workflow

.editorconfig

@@ -1,23 +1,21 @@
-# EditorConfig — Phenotype org canonical
-# https://editorconfig.org
 root = true
 
 [*]
-charset = utf-8
+indent_style = space
+indent_size = 2
 end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
 insert_final_newline = true
-indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.rs]
 indent_size = 4
-trim_trailing_whitespace = true
 
-[*.{rs,toml,py,go,md,yaml,yml,json,html,css,scss}]
+[*.py]
 indent_size = 4
 
-[*.{ts,tsx,js,jsx,mjs,cjs}]
+[*.toml]
 indent_size = 2
-
-[Makefile]
-indent_style = tab
-
-[*.md]
-trim_trailing_whitespace = false  # trailing spaces = line break in Markdown

.github/CODEOWNERS

@@ -0,0 +1,21 @@
+# CODEOWNERS — default reviewers for this repository.
+# Order matters: later rules override earlier ones.
+
+* @KooshaPari
+
+# Governance / meta
+/.github/                @KooshaPari
+/SECURITY.md             @KooshaPari
+/CODEOWNERS              @KooshaPari
+/.github/CODEOWNERS      @KooshaPari
+
+# Per-ecosystem drill-down
+/rust/                    @KooshaPari
+/electron/                @KooshaPari
+/open-sse/                @KooshaPari
+/desktop-electrobun/      @KooshaPari
+/docs/                    @KooshaPari
+/crates/                  @KooshaPari
+
+# CI ownership
+/.github/workflows/       @KooshaPari

.github/dependabot.yml

@@ -0,0 +1,48 @@
+# Dependabot configuration for OmniRoute.
+version: 2
+
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule: { interval: "weekly", day: "monday", time: "09:00", timezone: "America/New_York" }
+    open-pull-requests-limit: 5
+    reviewers: ["KooshaPari"]
+    commit-message: { prefix: "chore(deps)", include: "scope" }
+    labels: ["dependencies", "automated"]
+    groups:
+      react-ecosystem:
+        patterns: ["react*", "@types/react*"]
+      testing-frameworks:
+        patterns: ["vitest*", "playwright*", "@testing-library/*", "jest*"]
+      build-tools:
+        patterns: ["vite*", "next*", "turbo*", "eslint*", "typescript*"]
+
+  - package-ecosystem: "npm"
+    directory: "/open-sse"
+    schedule: { interval: "weekly", day: "monday" }
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "automated"]
+
+  - package-ecosystem: "npm"
+    directory: "/electron"
+    schedule: { interval: "weekly", day: "monday" }
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "automated"]
+
+  - package-ecosystem: "npm"
+    directory: "/desktop-electrobun"
+    schedule: { interval: "weekly", day: "monday" }
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "automated"]
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule: { interval: "weekly", day: "monday" }
+    open-pull-requests-limit: 3
+    labels: ["dependencies", "docker"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule: { interval: "weekly", day: "monday" }
+    open-pull-requests-limit: 5
+    labels: ["dependencies", "ci"]

.github/scorecard.yml

@@ -0,0 +1,20 @@
+name: scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '17 6 * * *'
+permissions:
+  contents: read
+  id-token: write
+  actions: read
+  security-events: write
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run analysis
+        uses: ossf/scorecard-action@4e7e316b1fcd3a4b6e10a49c3c9c5b8b6e6e6e6e
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true

.github/workflows/scorecard.yml

@@ -0,0 +1,48 @@
+name: OpenSSF Scorecard
+
+on:
+  workflow_dispatch:
+  branch_protection_rule:
+  schedule:
+    - cron: '0 9 * * 1'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: read-all
+
+jobs:
+  scorecard:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+
+      - name: Run OpenSSF Scorecard
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: scorecard-sarif
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@0daab03d71ff584ef619d027a3fd9146679c5d84
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -167,6 +167,13 @@ http-client.private.env.json
 scripts/i18n/_audit.json
 scripts/i18n/_pending-keys.json
 
+# i18n translation content (ADR-0005 — generated by scripts/i18n/sync.mjs;
+# checked-in copies are 682K MD LOC of machine translation in 40+ languages.
+# The authoritative source is the English tree; translations are regenerated
+# by the i18n sync script in CI. Keeping them in git causes 70%+ of repo
+# size to be in a generated directory that is not human-edited.)
+docs/i18n/
+
 # Private workflow / skill / command implementations
 # These contain proprietary multi-phase logic and should not be committed
 .agents/workflows/implement-features-ag.md